The basket carries more than food: the full itemised list travels to the merchant and the courier, and order history feeds the ad market through named networks and brokers. How long it stays is their claim, and a dispute extends even that.
Address and habit data. Worth listing.
Order and address history is kept for years; courier checks longer.
Ordering needs payment and address; couriers pass identity and right-to-work checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
Your home address sits attached to your name, your phone number and the hours you are usually in. Breaches here have spilled that exact set for millions of customers at once.
The basket carries more than food
On a delivery order your name, your delivery address and the full itemised basket travel to the merchant and the courier. The item list is not only food: a prescription or an allergy can ride inside it, and an age-restricted order can put your ID under a scan at the door. The receipt is also a map to your home.
Your order history feeds the ad market
What you ate, when and where becomes ad-targeting input. Several policies name the ad networks and data brokers the order-linked identifiers flow into, and the same brokers recur across rival apps. Some also buy demographic data from brokers to thicken the profile your orders started. In the US, several policies call this flow a sale or a share and leave the opt-out to you.
How long it stays is their claim
Most policies name no number: they keep your record as long as they judge necessary, and a complaint or an anticipated dispute extends even that, with no limit stated. Where a policy does set a ceiling it runs long: fifteen years in one, seven in another. Deleting the account, not the data, is what sets anything moving, and one policy allows itself around ninety days to carry the deletion out.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Delivery addresses map where you are and when.
Dietary and pharmacy orders can imply conditions.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
Payroll, right-to-work, and pension records carry statutory retention.
To flag suspected fraud, often on a shared industry database you cannot reach through the company.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
Your home address tied to your order history is a single record the ad market buys and a breach spills. One platform traded its customers' names, addresses and order histories into a marketing cooperative, and a US state regulator called that a sale. Breaches have exposed the same pairing of name, home address and phone number for millions of customers at once.
Order and location data has a resale and partnership market.
Ordering patterns train demand and routing models.
Anonymised is their word. Delivery addresses and times are mobility data, where four time-and-place points single out 95% of people (de Montjoye et al., 2013).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“if you have consented by enabling location access, we may receive and store your precise location information, including when our apps are running in the foreground or background”
With location turned on, the app can take your device's precise position for the span of the order, and in this wording even while it sits in the background of your phone. Your delivery address becomes a live read rather than a stored field until the order arrives.
THE MOVE A request pulls the location history they hold and where it went. The reply, or the silence, goes on your record.
“may constitute a 'sale' or 'sharing' of your Personal Information”
In the US, order-linked identifiers flow to advertising partners as something of value, and the wording keeps it a maybe. The flow runs on by default and switching it off is left to you.
THE MOVE A request demands opt-out of that sale and sharing and records it. Their reply, or the silence, goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →